PT-2020-6733 · Libvirt+4 · Libvirt+4

Published 2020-03-25 · Updated 2024-11-13 · CVE-2020-12430

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libvirt versions 4.10.0 through 6.0

Description The issue is related to a memory leak in the virDomainListGetStats libvirt API, which is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service. The memory leak is caused by incorrect memory release before removing the last reference.

Recommendations For libvirt versions 4.10.0 through 6.0, update to version 6.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the virDomainListGetStats API to minimize the risk of exploitation. Avoid using the domstats command until the issue is resolved.

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2020-1595

ALT-PU-2021-1690

ALT-PU-2021-1965

BDU:2022-05833

CVE-2020-12430

DLA-3778-1

MGASA-2020-0250

OPENSUSE-SU-2024:14490-1

SUSE-SU-2020:1208-1

SUSE-SU-2020:1277-1

USN-4371-1

Affected Products

Alt Linux

Astra Linux

Suse

Ubuntu

Libvirt

References · 50

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0926SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12430 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1208-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1804548 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12430 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-12430 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10703 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1828190 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-12430 · Vendor Advisory
• https://usn.ubuntu.com/4371-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5719.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5720.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4371-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12430 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12430 · Security Note